August 2026 at Bindplane: Full-Pipeline Blueprints and Scoped API keys

Full-Pipeline Blueprints are the headline, and Scoped API Keys went to preview. Here is the rundown.

▶️ Prefer to watch? The August Community Call is streamed live on YouTube. 👇

What shipped

Full-Pipeline Blueprints are what they sound like. Insert one blueprint and get a complete pipeline, source, processing, routing, and destination, connected end to end. Blueprints used to be processor bundles, which solved the repetitive middle but still left you to pick the source, batch for your backend, and wire the routing yourself. This closes that gap.

Five ship to start. Each one drops into the Advanced Pipeline Editor and is yours after insertion, every node is a Bindplane resource you can rename, swap, or delete.

• Ingest and Process Apache Common Logs for Elasticsearch: parses CLF, filters health-check and static-asset noise, maps status codes to severity, masks sensitive data, drops high-cardinality fields, adds Elastic Common Schema fields, samples successes, dedupes error bursts, and batches. Eleven processors pre-configured for Apache and Elasticsearch.
• Ingest and Process NGINX Logs for Elasticsearch: the same treatment for NGINX access logs in combined format, down through ECS fields, sampling, dedup, and batching. Eleven processors pre-configured for NGINX and Elasticsearch.
• Standardize & Route Windows Events for Google SecOps: standardizes Windows Events and routes each channel (SYSMON, POWERSHELL, DNS, MSSQL, WINEVTLOG) through its own batch processor, so batches stay homogeneous per SecOps log type.
• Enrich Palo Alto Security Events for Dynatrace: takes PAN-OS logs over TCP and UDP, parses thirteen log types, and adds MITRE ATT&CK context across sixteen techniques before batching for Dynatrace. Thirty-two processors pre-configured for Palo and Dynatrace.
• Reduce and Normalize Host Telemetry for Dynatrace: the cost-control one, host metrics and journald logs in a single pipeline, dropping idle and low-value data, collapsing per-core CPU to a host-level value, and renaming journald fields to OpenTelemetry names. Nine processors pre-configured for Journald logs, host metrics, and Dynatrace.

Scoped API Keys are live in Bindplane Cloud. Until now an API key could do anything the account could do, which is fine until you have to hand one to a script, a teammate, or a CI job and would rather not give full access. A scoped key is bound to a single organization or project and carries a role, so it opens exactly the door you meant it to.

New features and integrations

A few smaller things shipped alongside the headliners.

On the ingest side, the Google Cloud Storage Pub/Sub source now decides how to read an object from its content. The source decompresses gzip, bzip2, xz, zstd, lz4, snappy, lzma, and lzip, and it expands tar, zip, 7z, and rar archives, reading each file inside as its own records.

We also added two new parser functions to the transform processor, one for CEF and one for Extended Log Format, that turn those security formats into structured JSON. They follow the same upstream-first approach as the LEEF parser from earlier, so the transform processor's parser family now covers most of the common security log shapes.

What we wrote and where we showed up

I wrote a post for Full-Pipeline Blueprints, walking through how one blueprint drops in a complete pipeline in a single click. It is still in preview, so the public link will follow once it is live.

Dylan wrote How to Reduce Data Costs with OpenTelemetry and Bindplane, a practical look at filtering, dropping fields, and sampling to cut volume before it reaches a billable backend.

Amrith wrote OpenTelemetry at the Edge, on running collectors on IoT and edge hardware with Bindplane and Dynatrace, including what to do when the network is metered and every byte counts.

Dylan also refreshed a two-part guide to putting Bindplane in front of Splunk. Part one routes Splunk Universal Forwarder data to a Heavy Forwarder and Google Cloud Logging, and part two adds a Journald source and trims fields with transform processors before sending.

Bindplane also showed up somewhere we did not write it: Dynatrace's breakdown of the new US federal logging rules names Bindplane as part of the collection story.

What we're working toward

Next month you can find us at GrrCON, the security summit in Grand Rapids, Michigan, on September 24 and 25 at DeVos Place. If you run security logging or OTel pipelines, come say hi. More full-pipeline blueprints are on the way, covering more sources and more destinations, so if there is a combination you want to see next, tell us in the community Slack. Otherwise, go insert a blueprint and see how far a single click gets you.

See you in September.